MALICIOUS
126
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF contains numerous links to external domains, with one prominent URL being `https://xezojetit.ru/strik?utm_term=is+adobe+premiere+pro+free`. This URL, combined with the heuristic `PDF_SEO_DISPOSABLE_LINK_FARM`, indicates a phishing or malware distribution attempt. The ML classifier and ClamAV detection strongly suggest malicious intent, likely related to phishing or trojan delivery.
Machine Learning
- Nyx PDF Classifier malicious score 0.9993
Heuristics 5
-
ClamAV: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
-
Small PDF is a non-clustered link farm on disposable hosting medium PDF_SEO_DISPOSABLE_LINK_FARMSmall PDF contains many clickable external PDF links spread thin across many distinct hosts (no single dominant host), corroborated by a utm_term SEO-redirector link and/or links parked on free/disposable content hosts. This is the 'free document/template' SEO phishing PDF family, which ranks for search queries and routes users into payload/redirect chains, rather than a normal document citation pattern. The PDF itself carries no exploit — the risk is the linked destinations.
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://xezojetit.ru/strik?utm_term=is+adobe+premiere+pro+free PDF link annotation
- https://cdn.sqhk.co/ruwiketi/j53E9ja/zamoma.pdfIn PDF document text
- https://cdn.sqhk.co/zimajigon/KhbH3r1/bubble_shooter_crack_pc_game_setup_download.pdfIn PDF document text
- http://devazabekodum.iblogger.org/jio_phone_video_calling_kaise_kare.pdfIn PDF document text
- http://mavpa.fun/asparagus_racemosus_review2zfw1.pdfIn PDF document text
- https://cdn.sqhk.co/zonigita/cjaiiJy/4235443373.pdfIn PDF document text
- http://profaudit32.ru/all_the_things_you_are_pianoz2ctb.pdfIn PDF document text
- https://cdn.sqhk.co/dinigivo/gYnhcha/donuribomowoso.pdfIn PDF document text
- https://cdn.sqhk.co/gixelotopa/iibeLD6/wepugotujufutewumilujo.pdfIn PDF document text
- http://vidclips.design/17027219641zuja2.pdfIn PDF document text
- http://www.ascendercorp.com/In PDF document text
- http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
- https://uploads.strikinglycdn.com/files/da8aa3a0-b927-4169-b5b8-91c07b60ff62/used_firefly_2_vaporizer_for_sale.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/7c24966a-55c7-4e35-8da4-c53ef99390cd/model_3_price_california.pdfIn PDF document text
- http://liwivudelaje.epizy.com/97950542411.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/38134321-0555-4b42-993b-3e8869dc8150/36508945986.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/144c5938-2ec6-4d09-98f8-1e45fbaed5c3/feduwalinofux.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/23d35f28-a456-498b-8c4c-10cfbe15f62d/27127534344.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/920cb61f-1722-45ac-b33a-13d0b0ca249b/mowifad.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/5d1dd643-9bc4-4ba2-a4d1-7d09ad1d03fc/gedula.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/9e74fa24-f4a9-4daf-adfc-99cfcd186b0f/how_to_pair_bluetooth_jensen_jdvd1500.pdfIn PDF document text
- http://lojogonofar.rf.gd/how_to_make_a_tree_of_life_dreamcatcher.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/692a4655-cef7-4ca1-99c0-67f4e822c8dc/7829729255.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/ec6d66d3-0d78-4369-af7b-703152b80508/biologia_celular_y_molecular_alberts_descargar_gratis.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/81f4cb7e-bf25-466a-9df6-b2297926e6a0/gigavetonuzajivobagodozex.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/bab55c93-11ac-47f8-9842-406236c3eeaa/how_to_cross_the_river_styx.pdfIn PDF document text
- http://sulumasofip.epizy.com/3d_cardboard_horse_template.pdfIn PDF document text
- https://uploads.strikinglycdn.com/files/adc8a5b1-05c9-48a9-a6d5-471237f729fb/what_do_destructive_waves_do.pdfIn PDF document text
- http://www.w3.org/1999/02/22-rdf-syntax-ns#In PDF document text
- http://purl.org/dc/elements/1.1/In PDF document text
- http://ns.adobe.com/pdf/1.3/In PDF document text
- http://ns.adobe.com/xap/1.0/In PDF document text
- http://ns.adobe.com/xap/1.0/mm/In PDF document text
- http://ns.adobe.com/xap/1.0/rights/In PDF document text
- http://scripts.sil.org/OFLIn PDF document text
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0001076d.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x1076D | 5232 bytes |
SHA-256: 2c460ab2c375f979a8e6e0ba1092e53f4b60c3bbd29069571c5698df657e22b6 |
|||
font_01_sfnt_off00011920.bin |
pdf-font-stream | PDF embedded font (sfnt) at offset 0x11920 | 11332 bytes |
SHA-256: 525e173037908c4d2ac9ddbdff617d19c86300f81e07339201076e6c96fdd2e0 |
|||
Open this report in the interactive analyzer, or submit your own file for analysis.